doc/html/Server-security/index.html

   1 <!DOCTYPE html>
   2 <!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
   3 <!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
   4 <head>
   5   <meta charset="utf-8">
   6   <meta http-equiv="X-UA-Compatible" content="IE=edge">
   7   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   8
   9
  10   <link rel="shortcut icon" href="../img/favicon.ico">
  11   <title>Server security - Shaarli Documentation</title>
  12   <link href='https://fonts.googleapis.com/css?family=Lato:400,700|Roboto+Slab:400,700|Inconsolata:400,700' rel='stylesheet' type='text/css'>
  13
  14   <link rel="stylesheet" href="../css/theme.css" type="text/css" />
  15   <link rel="stylesheet" href="../css/theme_extra.css" type="text/css" />
  16   <link rel="stylesheet" href="../css/highlight.css">
  17   <link href="../github-markdown.css" rel="stylesheet">
  18
  19   <script>
  20     // Current page data
  21     var mkdocs_page_name = "Server security";
  22     var mkdocs_page_input_path = "Server-security.md";
  23     var mkdocs_page_url = "/Server-security/";
  24   </script>
  25
  26   <script src="../js/jquery-2.1.1.min.js"></script>
  27   <script src="../js/modernizr-2.8.3.min.js"></script>
  28   <script type="text/javascript" src="../js/highlight.pack.js"></script>
  29
  30 </head>
  31
  32 <body class="wy-body-for-nav" role="document">
  33
  34   <div class="wy-grid-for-nav">
  35
  36
  37     <nav data-toggle="wy-nav-shift" class="wy-nav-side stickynav">
  38       <div class="wy-side-nav-search">
  39         <a href=".." class="icon icon-home"> Shaarli Documentation</a>
  40         <div role="search">
  41   <form id ="rtd-search-form" class="wy-form" action="../search.html" method="get">
  42     <input type="text" name="q" placeholder="Search docs" />
  43   </form>
  44 </div>
  45       </div>
  46
  47       <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
  48         <ul class="current">
  49
  50
  51             <li class="toctree-l1">
  52
  53     <a class="" href="..">Home</a>
  54             </li>
  55
  56             <li class="toctree-l1">
  57
  58     <span class="caption-text">Setup</span>
  59     <ul class="subnav">
  60                 <li class="">
  61
  62     <a class="" href="../Download-and-Installation/">Download and Installation</a>
  63                 </li>
  64                 <li class="">
  65
  66     <a class="" href="../Upgrade-and-migration/">Upgrade and migration</a>
  67                 </li>
  68                 <li class="">
  69
  70     <a class="" href="../Server-requirements/">Server requirements</a>
  71                 </li>
  72                 <li class="">
  73
  74     <a class="" href="../Server-configuration/">Server configuration</a>
  75                 </li>
  76                 <li class=" current">
  77
  78     <a class="current" href="./">Server security</a>
  79     <ul class="subnav">
  80
  81     <li class="toctree-l3"><a href="#phpini">php.ini</a></li>
  82
  83         <ul>
  84
  85             <li><a class="toctree-l4" href="#locate-ini-files">Locate .ini files</a></li>
  86
  87         </ul>
  88
  89
  90     <li class="toctree-l3"><a href="#fail2ban">fail2ban</a></li>
  91
  92         <ul>
  93
  94             <li><a class="toctree-l4" href="#read-shaarli-logs-to-ban-ips">Read Shaarli logs to ban IPs</a></li>
  95
  96         </ul>
  97
  98
  99     <li class="toctree-l3"><a href="#robots-restricting-search-engines-and-web-crawler-traffic">Robots - Restricting search engines and web crawler traffic</a></li>
 100
 101
 102     </ul>
 103                 </li>
 104                 <li class="">
 105
 106     <a class="" href="../Shaarli-configuration/">Shaarli configuration</a>
 107                 </li>
 108                 <li class="">
 109
 110     <a class="" href="../Plugins/">Plugins</a>
 111                 </li>
 112     </ul>
 113             </li>
 114
 115             <li class="toctree-l1">
 116
 117     <span class="caption-text">Docker</span>
 118     <ul class="subnav">
 119                 <li class="">
 120
 121     <a class="" href="../Docker-101/">Docker 101</a>
 122                 </li>
 123                 <li class="">
 124
 125     <a class="" href="../Shaarli-images/">Shaarli images</a>
 126                 </li>
 127                 <li class="">
 128
 129     <a class="" href="../Reverse-proxy-configuration/">Reverse proxy configuration</a>
 130                 </li>
 131                 <li class="">
 132
 133     <a class="" href="../Docker-resources/">Docker resources</a>
 134                 </li>
 135     </ul>
 136             </li>
 137
 138             <li class="toctree-l1">
 139
 140     <span class="caption-text">Usage</span>
 141     <ul class="subnav">
 142                 <li class="">
 143
 144     <a class="" href="../Features/">Features</a>
 145                 </li>
 146                 <li class="">
 147
 148     <a class="" href="../Bookmarklet/">Bookmarklet</a>
 149                 </li>
 150                 <li class="">
 151
 152     <a class="" href="../Browsing-and-searching/">Browsing and searching</a>
 153                 </li>
 154                 <li class="">
 155
 156     <a class="" href="../Firefox-share/">Firefox share</a>
 157                 </li>
 158                 <li class="">
 159
 160     <a class="" href="../RSS-feeds/">RSS feeds</a>
 161                 </li>
 162                 <li class="">
 163
 164     <a class="" href="../REST-API/">REST API</a>
 165                 </li>
 166     </ul>
 167             </li>
 168
 169             <li class="toctree-l1">
 170
 171     <span class="caption-text">How To</span>
 172     <ul class="subnav">
 173                 <li class="">
 174
 175     <a class="" href="../Backup,-restore,-import-and-export/">Backup, restore, import and export</a>
 176                 </li>
 177                 <li class="">
 178
 179     <a class="" href="../Copy-an-existing-installation-over-SSH-and-serve-it-locally/">Copy an existing installation over SSH and serve it locally</a>
 180                 </li>
 181                 <li class="">
 182
 183     <a class="" href="../Create-and-serve-multiple-Shaarlis-(farm)/">Create and serve multiple Shaarlis (farm)</a>
 184                 </li>
 185                 <li class="">
 186
 187     <a class="" href="../Download-CSS-styles-from-an-OPML-list/">Download CSS styles from an OPML list</a>
 188                 </li>
 189                 <li class="">
 190
 191     <a class="" href="../Datastore-hacks/">Datastore hacks</a>
 192                 </li>
 193     </ul>
 194             </li>
 195
 196             <li class="toctree-l1">
 197
 198     <a class="" href="../Troubleshooting/">Troubleshooting</a>
 199             </li>
 200
 201             <li class="toctree-l1">
 202
 203     <span class="caption-text">Development</span>
 204     <ul class="subnav">
 205                 <li class="">
 206
 207     <a class="" href="../Development-guidelines/">Development guidelines</a>
 208                 </li>
 209                 <li class="">
 210
 211     <a class="" href="../Continuous-integration-tools/">Continuous integration tools</a>
 212                 </li>
 213                 <li class="">
 214
 215     <a class="" href="../GnuPG-signature/">GnuPG signature</a>
 216                 </li>
 217                 <li class="">
 218
 219     <a class="" href="../Coding-guidelines/">Coding guidelines</a>
 220                 </li>
 221                 <li class="">
 222
 223     <a class="" href="../Directory-structure/">Directory structure</a>
 224                 </li>
 225                 <li class="">
 226
 227     <a class="" href="../3rd-party-libraries/">3rd party libraries</a>
 228                 </li>
 229                 <li class="">
 230
 231     <a class="" href="../Plugin-System/">Plugin System</a>
 232                 </li>
 233                 <li class="">
 234
 235     <a class="" href="../Release-Shaarli/">Release Shaarli</a>
 236                 </li>
 237                 <li class="">
 238
 239     <a class="" href="../Versioning-and-Branches/">Versioning and Branches</a>
 240                 </li>
 241                 <li class="">
 242
 243     <a class="" href="../Security/">Security</a>
 244                 </li>
 245                 <li class="">
 246
 247     <a class="" href="../Static-analysis/">Static analysis</a>
 248                 </li>
 249                 <li class="">
 250
 251     <a class="" href="../Theming/">Theming</a>
 252                 </li>
 253                 <li class="">
 254
 255     <a class="" href="../Unit-tests/">Unit tests</a>
 256                 </li>
 257     </ul>
 258             </li>
 259
 260             <li class="toctree-l1">
 261
 262     <span class="caption-text">About</span>
 263     <ul class="subnav">
 264                 <li class="">
 265
 266     <a class="" href="../FAQ/">FAQ</a>
 267                 </li>
 268                 <li class="">
 269
 270     <a class="" href="../Community-&-Related-software/">Community & Related software</a>
 271                 </li>
 272     </ul>
 273             </li>
 274
 275         </ul>
 276       </div>
 277       &nbsp;
 278     </nav>
 279
 280     <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">
 281
 282
 283       <nav class="wy-nav-top" role="navigation" aria-label="top navigation">
 284         <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
 285         <a href="..">Shaarli Documentation</a>
 286       </nav>
 287
 288
 289       <div class="wy-nav-content">
 290         <div class="rst-content">
 291           <div role="navigation" aria-label="breadcrumbs navigation">
 292   <ul class="wy-breadcrumbs">
 293     <li><a href="..">Docs</a> &raquo;</li>
 294
 295
 296
 297           <li>Setup &raquo;</li>
 298
 299
 300
 301     <li>Server security</li>
 302     <li class="wy-breadcrumbs-aside">
 303
 304         <a href="https://github.com/shaarli/Shaarli/edit/master/docs/Server-security.md"
 305           class="icon icon-github"> Edit on GitHub</a>
 306
 307     </li>
 308   </ul>
 309   <hr/>
 310 </div>
 311           <div role="main">
 312             <div class="section">
 313
 314                 <h2 id="phpini">php.ini</h2>
 315 <p>PHP settings are defined in:
 316 - a main configuration file, usually found under <code>/etc/php5/php.ini</code>; some distributions provide different configuration environments, e.g.
 317     - <code>/etc/php5/php.ini</code> - used when running console scripts
 318     - <code>/etc/php5/apache2/php.ini</code> - used when a client requests PHP resources from Apache
 319     - <code>/etc/php5/php-fpm.conf</code> - used when PHP requests are proxied to PHP-FPM
 320 - additional configuration files/entries, depending on the installed/enabled extensions:
 321     - <code>/etc/php/conf.d/xdebug.ini</code></p>
 322 <h3 id="locate-ini-files">Locate .ini files</h3>
 323 <h4 id="console-environment">Console environment</h4>
 324 <pre><code class="bash">$ php --ini
 325 Configuration File (php.ini) Path: /etc/php
 326 Loaded Configuration File:         /etc/php/php.ini
 327 Scan for additional .ini files in: /etc/php/conf.d
 328 Additional .ini files parsed:      /etc/php/conf.d/xdebug.ini
 329 </code></pre>
 330
 331 <h4 id="server-environment">Server environment</h4>
 332 <ul>
 333 <li>create a <code>phpinfo.php</code> script located in a path supported by the web server, e.g.<ul>
 334 <li>Apache (with user dirs enabled): <code>/home/myself/public_html/phpinfo.php</code></li>
 335 <li><code>/var/www/test/phpinfo.php</code></li>
 336 </ul>
 337 </li>
 338 <li>make sure the script is readable by the web server user/group (usually, <code>www</code>, <code>www-data</code> or <code>httpd</code>)</li>
 339 <li>access the script from a web browser</li>
 340 <li>look at the <em>Loaded Configuration File</em> and <em>Scan this dir for additional .ini files</em> entries</li>
 341 </ul>
 342 <pre><code class="php">&lt;?php phpinfo(); ?&gt;
 343 </code></pre>
 344
 345 <h2 id="fail2ban">fail2ban</h2>
 346 <p><code>fail2ban</code> is an intrusion prevention framework that reads server (Apache, SSH, etc.) and uses <code>iptables</code> profiles to block brute-force attempts:
 347 - <a href="http://www.fail2ban.org/wiki/index.php/Main_Page">Official website</a>
 348 - <a href="https://github.com/fail2ban/fail2ban">Source code</a></p>
 349 <h3 id="read-shaarli-logs-to-ban-ips">Read Shaarli logs to ban IPs</h3>
 350 <p>Example configuration:
 351 - allow 3 login attempts per IP address
 352 - after 3 failures, permanently ban the corresponding IP adddress</p>
 353 <p><code>/etc/fail2ban/jail.local</code></p>
 354 <pre><code class="ini">[shaarli-auth]
 355 enabled  = true
 356 port     = https,http
 357 filter   = shaarli-auth
 358 logpath  = /var/www/path/to/shaarli/data/log.txt
 359 maxretry = 3
 360 bantime = -1
 361 </code></pre>
 362
 363 <p><code>/etc/fail2ban/filter.d/shaarli-auth.conf</code></p>
 364 <pre><code class="ini">[INCLUDES]
 365 before = common.conf
 366 [Definition]
 367 failregex = \s-\s&lt;HOST&gt;\s-\sLogin failed for user.*$
 368 ignoreregex =
 369 </code></pre>
 370
 371 <h2 id="robots-restricting-search-engines-and-web-crawler-traffic">Robots - Restricting search engines and web crawler traffic</h2>
 372 <p>Creating a <code>robots.txt</code> with the following contents at the root of your Shaarli installation will prevent <em>honest</em> web crawlers from indexing each and every link and Daily page from a Shaarli instance, thus getting rid of a certain amount of unsollicited network traffic.</p>
 373 <pre><code>User-agent: *
 374 Disallow: /
 375 </code></pre>
 376
 377 <p>See:
 378 - http://www.robotstxt.org/
 379 - http://www.robotstxt.org/robotstxt.html
 380 - http://www.robotstxt.org/meta.html</p>
 381
 382             </div>
 383           </div>
 384           <footer>
 385
 386     <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
 387
 388         <a href="../Shaarli-configuration/" class="btn btn-neutral float-right" title="Shaarli configuration">Next <span class="icon icon-circle-arrow-right"></span></a>
 389
 390
 391         <a href="../Server-configuration/" class="btn btn-neutral" title="Server configuration"><span class="icon icon-circle-arrow-left"></span> Previous</a>
 392
 393     </div>
 394
 395
 396   <hr/>
 397
 398   <div role="contentinfo">
 399     <!-- Copyright etc -->
 400
 401   </div>
 402
 403   Built with <a href="http://www.mkdocs.org">MkDocs</a> using a <a href="https://github.com/snide/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.
 404 </footer>
 405
 406         </div>
 407       </div>
 408
 409     </section>
 410
 411   </div>
 412
 413   <div class="rst-versions" role="note" style="cursor: pointer">
 414     <span class="rst-current-version" data-toggle="rst-current-version">
 415
 416           <a href="https://github.com/shaarli/Shaarli" class="fa fa-github" style="float: left; color: #fcfcfc"> GitHub</a>
 417
 418
 419         <span><a href="../Server-configuration/" style="color: #fcfcfc;">&laquo; Previous</a></span>
 420
 421
 422         <span style="margin-left: 15px"><a href="../Shaarli-configuration/" style="color: #fcfcfc">Next &raquo;</a></span>
 423
 424     </span>
 425 </div>
 426     <script src="../js/theme.js"></script>
 427
 428 </body>
 429 </html>